Hack the Route Start free Open app Hardening and auditing
SCAP and security benchmarks
A standard format for writing a security baseline as machine-checkable rules, and the tool that evaluates a host against it.
SCAP (Security Content Automation Protocol) is the standard that lets a security baseline be written once and
checked by any tool. A benchmark is a set of rules in XCCDF; each rule points at an OVAL check that
inspects the real host (a line in a config file, a file's permission bits, an installed version) and reports pass
or fail. Published benchmarks like the CIS Benchmarks and DISA STIGs ship as SCAP content. oscap xccdf eval runs a profile's rules against the machine and prints each result, turning "is this host hardened?" into a
repeatable, auditable scan rather than a manual checklist.